FakeUpdates/SocGholish Activity

Date: 09/19/2024

Severity: High

Summary

Identifies the initial execution of FakeUpdates/SocGholish malware through wscript, which subsequently runs commands using cmd or PowerShell.

ParentImage

'\wscript.exe'

ParentCommandLine

'\AppData\Local\Temp'

'.zip'

'update'

'.js'

'Chrome'

'Edge'

'Firefox'

'Opera'

'Brave'

'Vivaldi'

Image

'\cmd.exe'

'\powershell.exe'

'\pwsh.exe'

Detection Query 1	(resourcename = "Windows Security" AND eventtype = "4688" ) AND message In ("\AppData\Local\Temp",".zip","update",".js","Chrome","Edge","Firefox","Opera","Brave","Vivaldi") AND processname In ("\cmd.exe","\powershell.exe","\pwsh.exe")
Detection Query 2	technologygroup = "EDR" AND message In ("\AppData\Local\Temp",".zip","update",".js","Chrome","Edge","Firefox","Opera","Brave","Vivaldi") AND processname In ("\cmd.exe","\powershell.exe","\pwsh.exe")
Detection Query 3	(resourcename = "Sysmon" AND eventtype = "1" ) AND parentimage = "\wscript.exe" AND parentcommandline IN ("\AppData\Local\Temp",".zip","update",".js","Chrome","Edge","Firefox","Opera","Brave","Vivaldi") AND image In ("\cmd.exe","\powershell.exe","\pwsh.exe")
Detection Query 4	technologygroup = "EDR" AND parentimage = "\wscript.exe" AND parentcommandline IN ("\AppData\Local\Temp",".zip","update",".js","Chrome","Edge","Firefox","Opera","Brave","Vivaldi") AND image In ("\cmd.exe","\powershell.exe","\pwsh.exe")

Reference: